Erreur 503 sur Nginx

/etc/nginx/nginx.conf ou site.conf

http {
    # Timeouts globaux
    proxy_connect_timeout 60s;
    proxy_send_timeout 60s;
    proxy_read_timeout 60s;
    
    # Pour FastCGI (PHP-FPM)
    fastcgi_connect_timeout 60s;
    fastcgi_send_timeout 300s;
    fastcgi_read_timeout 300s;
}

/etc/nginx/sites-available/monsite.conf

server {
    # Timeouts standard
    location ~ \\.php$ {
        fastcgi_read_timeout 60s;
        # ... reste de la config
    }
    
    # Timeouts plus longs pour les opérations lourdes
    location ~ ^/(import|export|backup) {
        fastcgi_read_timeout 600s;  # 10 minutes
        fastcgi_send_timeout 600s;
        # ... reste de la config
    }
    
    # Webhook / callbacks externes
    location /webhook {
        proxy_read_timeout 120s;
        proxy_pass http://backend;
    }
}

/etc/nginx/nginx.conf

# Nombre de workers (auto = 1 par CPU)
worker_processes auto;

# Connexions par worker
events {
    worker_connections 4096;  # Défaut: 768
    use epoll;
    multi_accept on;
}

/etc/php/8.2/fpm/pool.d/www.conf

; Calculer selon RAM disponible
; max_children = RAM disponible (Mo) / Mémoire par process (~100-150 Mo)
; Exemple : 8 Go RAM = 8000 / 150 = ~50 workers

pm = dynamic
pm.max_children = 50          ; Maximum de workers
pm.start_servers = 10         ; Au démarrage
pm.min_spare_servers = 5      ; Minimum en attente
pm.max_spare_servers = 20     ; Maximum en attente
pm.max_requests = 500         ; Recycle après X requêtes (évite memory leaks)

/etc/nginx/nginx.conf

http {
    # Zones de limitation
    limit_conn_zone $binary_remote_addr zone=addr:10m;
    limit_req_zone $binary_remote_addr zone=req:10m rate=10r/s;
}

/etc/nginx/conf.d/upstream.conf

upstream backend_pool {
    # Méthode de répartition
    least_conn;  # ou round-robin (défaut), ip_hash
    
    # Serveurs backend
    server 192.168.1.10:80 weight=5;
    server 192.168.1.11:80 weight=3;
    server 192.168.1.12:80 backup;  # Utilisé si les autres sont down
    
    # Health checks (Nginx Plus) ou passive checks
    # max_fails=3 : 3 échecs avant de marquer down
    # fail_timeout=30s : Durée pendant laquelle le serveur est considéré down
    server 192.168.1.10:80 max_fails=3 fail_timeout=30s;
    
    # Keepalive connections
    keepalive 32;
}

upstream.conf

upstream backend_pool {
    server 192.168.1.10:80;
    server 192.168.1.11:80;
    
    # Serveur de secours (page maintenance statique)
    server 192.168.1.99:80 backup;
}

site.conf

server {
    # Page 503 personnalisée
    error_page 503 /maintenance.html;
    
    location = /maintenance.html {
        root /var/www/errors;
        internal;
        
        # Headers SEO
        add_header Retry-After 3600 always;
        add_header Cache-Control "no-store, no-cache" always;
    }
    
    location / {
        proxy_pass http://backend_pool;
        
        # Intercepter les 503 du backend
        proxy_intercept_errors on;
    }
}

Pour Nginx Plus

upstream backend_pool {
    zone backend 64k;
    
    server 192.168.1.10:80;
    server 192.168.1.11:80;
    
    # Health check actif
    health_check interval=5s fails=3 passes=2;
}

/usr/local/bin/check-backends.sh

#!/bin/bash
# Health check simple pour backends

BACKENDS="192.168.1.10 192.168.1.11"
ALERT_EMAIL="[email protected]"

for backend in $BACKENDS; do
    if ! curl -sf --max-time 5 "http://$backend/health" > /dev/null; then
        echo "$(date): Backend $backend DOWN" >> /var/log/backend-health.log
        echo "Backend $backend is down" | mail -s "ALERT: Backend down" $ALERT_EMAIL
    fi
done

/etc/nginx/sites-available/monsite.conf

server {
    listen 80;
    server_name monsite.com;
    root /var/www/monsite;
    
    # Vérifier si fichier maintenance existe
    set $maintenance 0;
    if (-f /var/www/monsite/.maintenance) {
        set $maintenance 1;
    }
    
    # Exclure certaines IPs
    if ($remote_addr = "123.456.789.012") {
        set $maintenance 0;
    }
    
    # Retourner 503 si maintenance
    if ($maintenance = 1) {
        return 503;
    }
    
    # Page de maintenance personnalisée
    error_page 503 @maintenance;
    
    location @maintenance {
        add_header Retry-After 3600 always;
        add_header Cache-Control "no-store, no-cache" always;
        rewrite ^(.*)$ /maintenance.html break;
    }
    
    # Configuration normale...
}

/etc/nginx/sites-available/monsite.conf

server {
    # Basculer manuellement : 0 = off, 1 = on
    set $maintenance_mode 0;
    
    # IPs autorisées même en maintenance
    geo $maintenance_bypass {
        default 0;
        123.456.789.012 1;  # Admin 1
        98.76.54.321 1;     # Admin 2
    }
    
    # Logique de maintenance
    set $show_maintenance "${maintenance_mode}${maintenance_bypass}";
    
    if ($show_maintenance = "10") {
        return 503;
    }
    
    error_page 503 @maintenance;
    
    location @maintenance {
        root /var/www/errors;
        add_header Retry-After 7200 always;
        try_files /maintenance.html =503;
    }
}

/etc/nginx/conf.d/maintenance-schedule.conf

# Carte horaire de maintenance
# Format : HHMM
map $time_iso8601 $maintenance_window {
    default 0;
    "~^.{11}0[234]:"  1;  # Entre 02:00 et 04:59
}

/etc/nginx/nginx.conf

user www-data;
worker_processes auto;
pid /run/nginx.pid;
worker_rlimit_nofile 65535;

events {
    worker_connections 4096;
    use epoll;
    multi_accept on;
}

http {
    # === BASIC ===
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    types_hash_max_size 2048;
    server_tokens off;  # Masquer version Nginx
    
    include /etc/nginx/mime.types;
    default_type application/octet-stream;
    
    # === LOGGING ===
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                    '$status $body_bytes_sent "$http_referer" '
                    '"$http_user_agent" $request_time';
    
    access_log /var/log/nginx/access.log main;
    error_log /var/log/nginx/error.log warn;
    
    # === TIMEOUTS ===
    keepalive_timeout 65;
    client_body_timeout 12;
    client_header_timeout 12;
    send_timeout 10;
    
    # === BUFFERS ===
    client_body_buffer_size 10K;
    client_header_buffer_size 1k;
    client_max_body_size 64M;
    large_client_header_buffers 4 8k;
    
    # === GZIP ===
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 5;
    gzip_min_length 256;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/json
        application/javascript
        application/xml
        application/xml+rss
        image/svg+xml;
    
    # === RATE LIMITING ===
    limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
    limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
    limit_conn_zone $binary_remote_addr zone=addr:10m;
    
    # === FASTCGI (PHP) ===
    fastcgi_connect_timeout 60s;
    fastcgi_send_timeout 180s;
    fastcgi_read_timeout 180s;
    fastcgi_buffer_size 128k;
    fastcgi_buffers 256 16k;
    fastcgi_busy_buffers_size 256k;
    fastcgi_temp_file_write_size 256k;
    
    # === PROXY (si reverse proxy) ===
    proxy_connect_timeout 60s;
    proxy_send_timeout 60s;
    proxy_read_timeout 60s;
    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;
    
    # === INCLUDES ===
    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;
}

/etc/nginx/sites-available/monsite.conf

server {
    listen 80;
    server_name monsite.com www.monsite.com;
    return 301 https://monsite.com$request_uri;
}

server {
    listen 443 ssl http2;
    server_name monsite.com;
    root /var/www/monsite;
    index index.php index.html;
    
    # === SSL ===
    ssl_certificate /etc/letsencrypt/live/monsite.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/monsite.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    
    # === MAINTENANCE MODE ===
    set $maintenance 0;
    if (-f /var/www/monsite/.maintenance) {
        set $maintenance 1;
    }
    # Whitelist IPs
    if ($remote_addr = "VOTRE_IP") {
        set $maintenance 0;
    }
    if ($maintenance = 1) {
        return 503;
    }
    
    error_page 503 @maintenance;
    location @maintenance {
        add_header Retry-After 3600 always;
        add_header Cache-Control "no-store" always;
        root /var/www/errors;
        try_files /maintenance.html =503;
    }
    
    # === SECURITY ===
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-XSS-Protection "1; mode=block" always;
    
    # === RATE LIMITING ===
    limit_conn addr 20;
    limit_req zone=general burst=20 nodelay;
    
    # === LOCATIONS ===
    
    # Fichiers statiques
    location ~* \\.(jpg|jpeg|png|gif|ico|css|js|woff2?|svg|webp)$ {
        expires 30d;
        add_header Cache-Control "public, immutable";
        access_log off;
    }
    
    # PHP
    location ~ \\.php$ {
        try_files $uri =404;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
    
    # Login / Admin - Rate limiting strict
    location ~ ^/(wp-login\\.php|admin|administrator) {
        limit_req zone=login burst=5 nodelay;
        try_files $uri =404;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
    
    # Bloquer xmlrpc (WordPress)
    location = /xmlrpc.php {
        deny all;
        return 444;
    }
    
    # Status pages (accès local uniquement)
    location /nginx_status {
        stub_status on;
        allow 127.0.0.1;
        deny all;
    }
    
    location /fpm-status {
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
        allow 127.0.0.1;
        deny all;
    }
    
    # Fallback
    location / {
        try_files $uri $uri/ /index.php?$args;
    }
}

/usr/local/bin/check-nginx-health.sh

#!/bin/bash
# Surveillance santé Nginx + PHP-FPM

ALERT_EMAIL="[email protected]"
SITE_URL="https://monsite.com"

# Vérifier que Nginx tourne
if ! systemctl is-active --quiet nginx; then
    echo "CRITICAL: Nginx is down" | mail -s "[ALERT] Nginx down" $ALERT_EMAIL
    systemctl restart nginx
    exit 1
fi

# Vérifier que PHP-FPM tourne
if ! systemctl is-active --quiet php8.2-fpm; then
    echo "CRITICAL: PHP-FPM is down" | mail -s "[ALERT] PHP-FPM down" $ALERT_EMAIL
    systemctl restart php8.2-fpm
    exit 1
fi

# Vérifier que le site répond
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 10 "$SITE_URL")

if [ "$HTTP_CODE" != "200" ]; then
    echo "WARNING: Site returned HTTP $HTTP_CODE" | mail -s "[ALERT] Site HTTP $HTTP_CODE" $ALERT_EMAIL
    exit 1
fi

# Vérifier les workers PHP disponibles
FPM_STATUS=$(curl -s "http://localhost/fpm-status" 2>/dev/null)
IDLE=$(echo "$FPM_STATUS" | grep "idle processes" | awk '{print $3}')

if [ -n "$IDLE" ] && [ "$IDLE" -lt 2 ]; then
    echo "WARNING: Only $IDLE idle PHP workers" | mail -s "[WARN] PHP workers low" $ALERT_EMAIL
fi

exit 0